IBM Tivoli Storage Manager Buffer Overflows in Journal Based Backup Clients Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1025741 |
|
SecurityTracker URL: http://securitytracker.com/id/1025741
|
|
CVE Reference:
CVE-2011-1222, CVE-2011-1223
(Links to External Site)
|
Date: Jul 1 2011
|
Impact:
Execution of arbitrary code via local system, User access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 6.2.0.0 through 6.2.1.3, 6.1.0.0 through 6.1.3.5, 5.5.0.0 through 5.5.2.12, 5.4.0.0 through 5.4.3.3
|
Description:
A vulnerability was reported in IBM Tivoli Storage Manager. A local user can obtain elevated privileges on the target system.
A local user can trigger a buffer overflow in the Windows and AIX Journal Based Backup client functions to execute arbitrary code on the target system with elevated privileges [CVE-2011-1222].
A local user can trigger a buffer overflow in the Windows backup-archive client alternate data stream processing to execute arbitrary code on the target system with elevated privileges [CVE-2011-1223].
|
Impact:
A local user can obtain elevated privileges on the target system.
|
Solution:
The vendor has issued a fix (APARs IC77049, IC77052; 5.4.3.4, 5.5.3, 6.1.4, 6.2.2).
The vendor's advisory is available at:
https://www-304.ibm.com/support/docview.wss?uid=swg21457604
|
Vendor URL: www-304.ibm.com/support/docview.wss?uid=swg21457604 (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
UNIX (AIX), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 01 Jul 2011 19:20:50 +0000
Subject: IBM Tivoli Storage Manager
|
https://www-304.ibm.com/support/docview.wss?uid=swg21457604
CVE-2011-1222
CVE-2011-1223
|
|
